RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-20 13:05:07 +00:00
Code Issues Activity Actions

LibCore: Prefer strlcpy over strncpy, fix overflow

Browse source 
A malicious caller can create a SocketAddress for a local unix socket with an
over-long name that does not fit into struct sock_addr_un.
- Socket::connet: This caused the 'sun_path' field to
  overflow, probably overwriting the return pointer of the call frame, and thus
  crashing the process (in the best case).
- SocketAddress::to_sockaddr_un: This triggered a RELEASE_ASSERT, and thus
  crashing the process.

Both have been fixed to return a nice error code instead of crashing.
This commit is contained in:
Ben Wiederhake 2020-08-23 13:47:52 +02:00 • committed by Andreas Kling
parent d419a780ae
commit e682967d7e
4 changed files with 25 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Services/SystemServer/Service.cpp
View file

@ -135,7 +135,12 @@ void Service::setup_socket()
}
auto socket_address = Core::SocketAddress::local(m_socket_path);
auto un = socket_address.to_sockaddr_un();
auto un_optional = socket_address.to_sockaddr_un();
if (!un_optional.has_value()) {
dbg() << "Socket name " << m_socket_path << " is too long. BUG! This should have failed earlier!";
ASSERT_NOT_REACHED();
}
auto un = un_optional.value();
int rc = bind(m_socket_fd, (const sockaddr*)&un, sizeof(un));
if (rc < 0) {
perror("bind");
@ -358,6 +363,8 @@ Service::Service(const Core::ConfigFile& config, const StringView& name)
ASSERT(!m_accept_socket_connections || (!m_socket_path.is_null() && m_lazy && m_multi_instance));
// MultiInstance doesn't work with KeepAlive.
ASSERT(!m_multi_instance || !m_keep_alive);
// Socket path (plus NUL) must fit into the structs sent to the Kernel.
ASSERT(m_socket_path.length() < UNIX_PATH_MAX);
if (!m_socket_path.is_null() && is_enabled()) {
auto socket_permissions_string = config.read_entry(name, "SocketPermissions", "0600");